ImageMagick’s MagnifyImage function uses a fixed-size stack buffer; a specially crafted image can overflow it, corrupting the stack and potentially allowing an attacker to execute arbitrary code. The flaw is a classic buffer overflow (CWE‑121 and CWE‑787).

The vulnerability impacts all versions of ImageMagick older than 7.1.2‑16 and 6.9.13‑41. Any installation that processes images through MagnifyImage is susceptible.

With a CVSS score of 7.7 the flaw is high severity, but an EPSS below 1% indicates a low current exploitation probability. The vulnerability is not listed in the KEV catalog, so no widespread attacks have been reported. The likely attack vector is an attacker supplying a malicious image to a service that uses MagnifyImage, leading to complete code‑execution on the host system.